20th annual e-Crime & Cybersecurity Congress

20 years ago, e-Crime was new, and cybersecurity embryonic. Today digital threats undermine everything from our hospitals and schools to our democracies. So, how can government, infrastructure providers and solution vendors do better to keep business, society and individuals safe?

Twenty years ago, a handful of far-sighted individuals in government, law enforcement and the private sector got together to launch the first e-Crime Congress. That year, Microsoft released Internet Explorer 6.0; Apple introduced macOS X 10.1, the iPod and Apple earbuds; and Bungie released the game Halo for the newly-launched Xbox gaming system.

More significantly for those watching the emerging world of digital threats, a new infection technique appeared: users no longer needed to download files – visiting an infected website was enough as bad actors replaced clean pages with infected ones or ‘hid’ malware on legitimate webpages. Instant messaging services also began to get attacked, and worms designed to propagate via IRC (Internet Chat
Relay) channel also arrived.

Cybersecurity was in its infancy. It was a niche, geeky, IT specialism. Companies, in general, paid it little attention. And not much changed for a number of years. Today, scarcely a day passes without news of a significant attack; single attacks are costing companies tens and even hundreds of million of dollars; politicians are raising cyberespionage at global summits and losses due to cybersecurity are
forecast to hit $10.5 trillion in 2025.

The regulators are on the case. Operational resilience in critical sectors of the economy is now a key focus. Data privacy legislation is well established. And fines for cyber-related misconduct are beginning to be imposed. Just recently, the U.S. Securities and Exchange Commission (SEC) signaled a significant change in how it thinks about what constitutes a threat to companies: It now considers cyber
vulnerabilities to be an existential business risk.

This was evident in fines levied against two companies over inadequate disclosures of cybersecurity issues — British publishing company Pearson PLC and First American Financial Corp. In mid-August, the SEC announced that Pearson had agreed to pay $1 million to settle charges that it misled investors following a 2018 breach and theft of millions of student records.